In a landmark decision both the Brazilian Data Protection Agency (ANPD) and European authorities recognized mutual adequacy in relation to the protection of personal data. It follows several institutional engagements between the ANPD and the European Data Protection Board (EDPB) throughout 2025. The official announcement will take place tomorrow (01/27).
The decision will significantly facilitate business between Brazil and the EU as it allows for transfer of personal data in a direct, secure and simplified way.
Under the LGPD, international transfers of personal data are permitted only in specific circumstances or subject to appropriate safeguards. One such legal basis is a transfer to countries or international organizations that ensure a level of data protection adequate and essentially equivalent to that provided under the LGPD, now formally recognized in the case of the European Union. Until now, companies that could not rely on other transfer mechanisms were required to execute standard contractual clauses (SCCs) in the format issued by the ANPD. With the adequacy recognition, SCCs are no longer required for transfers to the EU, although they remain necessary for transfers to other jurisdictions.
This decision does not exempt companies from complying with core data protection requirements. Organizations must still rely on valid lawful bases, respect purpose limitation, and ensure that processing and transfers serve legitimate, specific, explicit, and informed purposes vis-à-vis data subjects. The adequacy decision merely confirms that the EU and Brazil provide an equivalent level of protection. Moreover, the LGPD continues to apply to data transfers to the EU in situations that may infringe or jeopardize compliance with the general principles of data protection and data subject rights established under Brazilian law.